Slashdot Mirror
A Little .Mac Security Flaw
deleuth writes "The de facto online connectivity software sold along with many Apple computers, .Mac, has a Web interface through which users can check their 'iDisk' while away from their own computer. However, there is no Log-Out button in this Web interface, so most users just close the browser and walk away... not realizing that their iDisk has been cached by the browser and that anyone who wants to can open up the browser, go back to the link in History, and get into their iDisk completely logged in. From here, files can be downloaded and/or deleted. This seems like a minor security flaw via bad interface design, and podcaster Klaatu (of thebadapples.info) posted this on the discussion.apple.com site, only to have his post removed by Apple. Furthermore, feedback at apple.com/feedback has gone unanswered. The problem remains: there is no way for the average computer user to log-out of their iDisk on public computers. A quick review of any public terminal's browser history could bring up all kinds of interesting things."
Am I the only one that notices that Apple's response to every problem is a swift "let's delete this topic and pretend the problem doesn't exist"? .. Seems like bad business practise to me.
Free means no restrictions, ironic the FSF's GPL forces restrictions, isn't it? What's your definition of free?
I love how this is a "little", "minor" security flaw, and even though Apple actively deleted the post exposing this information nobody's really up in arms as it's just due to "bad interface design". If this were a Microsoft property, people would be screaming bloody murder.
Tools > Clear Private Data in Firefox is the option you need.
Not having a log out button is bad design but many people forget to click them, you need a decent timeout to reduce the risk for those that don't log out.
Does this system keep you logged in (via cookies) if you close the browser and restart it? If so that's a very bad design.
Ah, well, see, so long as Apple makes sure no knows about this, it won't be a problem. Surly everyone on Slashdot sees the validity of this strategy. (God I love my sig)
If you are about to mod me down, keep in mind that this post was most likely sarcastic.
After accessing your iDisk in Firefox:
In Safari:
Or if you remember to do so before visiting .Mac's iDisk page:
Problem solved.
So yes, there are ways for the average user to log-out of their iDisk from a public terminal. They just simply have to use the existing facilities at their disposal.
Yaz.
Is the iDisk connection encrypted, or is it wide open?
This sounds like a job that some sort of graphical SSH frontend could do better. (since OS X has ssh support built in)
"It is a denial of justice not to stretch out a helping hand to the fallen; that is the common right of humanity."
Slashdot editor kdawson and Slashdot submitter deleuth mysteriously disappear...
I've never noticed that before. Probably because desktop WebDav on OS X is so slow that I just use dedicated client apps. The poster isn't being perfectly clear on the whole process for accessing your iDisk via dot mac. Here's how it goes. You sign into dot mac, then you sign into your iDisk. Same username, same password for both. You get a web page that access your WebDav folder on Apple's servers. Signing out of dot mac doesn't sign you out of the iDisk. A simple history check pulls it right back up with full write access to your iDisk (clearly not from web cache). No one would expect that behavior. I would assume there is a network idle time out, as dotmac has.
In real experience terms, this isn't going to be much of an issue until it's fixed, but does put a small stain on the portability of the service. Which is one of Apples main advertising points for it. Gotta remember though, Apple, like all other companies is filled with a lot of people. There are moderators on Apple forums, for all we know one of them removed it then notified management of the problem and it's working it's way up the command. It's not like Steve Jobs read it and said, "OMGWTFBBQ!?!?! PULL THAT NOW!".
Though, the extra publicity will help.
Burn Hollywood Burn
I am an new Apple user. And reasonably happy.
However, there is one thing that I am very troubled by and it is simply this: Apple apparent arrogance and ignorance when it comes to security.
Apple has enjoyed a "blanket" of security because it is low profile and a niche. However, as its market share and mind share expands, this period of respite will soon fade.
You would think that, during this time, Apple would have used the opportunity to develop and internal culture, policies and procedures, as well as infrastructure for dealing effectively with security issues. However, the complete opposite appears to be the case.
Apple has failed miserably to publicly and actively address such issues. It also fails to respond in anything that could be called a rapid manner to reports of exploitable security holes. Taking actions such as deleting posts that point out security problems makes the situation worse, not better. Failing to publicly document the existence, status and nature of defects makes the situation worse, not better. Being secretive makes the situation worse, not better.
Apple makes decent hardware. Leopard is very nice to use, though far from perfect. The whole ecosystem and vertical integration is nice. However, the whole thing could come crashing down because of a serious security flaw. If people think Microsoft is susceptible to such a scenario, the Apple empire is even more so.
It's not a question of if, but when. Will Apple be prepared? So far, all signs point to "NO".
PS... the CAPTCHA word for this post was "condom".. how appropriate considering the whole point is to have a good profolactic. A good metaphore for Apple's current approach to security.
Yet another incident where Apple blatantly ignores the customers they claim to value so much...and they will likely continue to do so until there's such a shitstorm about this that they have no choice but to respond. Apple used to be a good company...ten years ago. Now they're just as bad (if not worse, in many regards) as every other IT giant out there. Sad.
I'm a geek girl. Seriously.
It sounds neat but mom isn't going to use it. My way to do the same thing is just to ssh to my desktop at work and do whatever. So, I wouldn't use something like iDisk. It is also neat that you can share large files with your buddies. otoh, people can share movies online without iDisk.
So, my question is, how many people actually use iDisk? How much of a problem is this actually.
Free means no restrictions
Your basic premise is wrong.
"When I first heard Daydream Nation it quite frankly scared the living shit out of me." -- Matthew Stearns
If you suppress bad news, it doesn't exist!
"The fight for freedom has only just begun." - Geert Wilders
Didn't you skip
step 0. Boot Linux from USB.
?
Assuming firefox will only use ramdisk for it's cache, of course...
No SSH session for transmission of personal data, and reliable logout for protection? Insane security practice from a now UNIX-certified OS vendor, especially when it comes to something so private as the transfer of one's hard disk contents to an internet backup? Ah well, it was bound to happen, and it has probably happened in the past, and will likely happen again in the future. Anyone can slip up.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Huh? You seem to have conflated their corporate policy, which is sometimes very stupid, with their security policy, which is generally good. The two have nothing to do with each other. Apple's overzealous moderation of their own forums is well known, and unfortunate. But it has nothing to do with how well they manage their OS security and how well they respond to exploits.
You are very mistaken, this incident does prove that Apple's security policies and responses are indeed lacking. Don't get fixated on the deletion of a post, consider that they did not respond by adding a logout option to a *web* interface.
Indeed; I'm somewhat amused that this is described as a "minor" security flaw in the summary and blamed on the user interface. If it was a Microsoft web site it would be described as a major flaw and the foaming at the mouth would begin. Nor is it a user interface problem; by using session cookies closing the browser would logout the user, with or without a logout button.
The site listed (but not linked) in the summary doesn't describe the issue as minor, or a UI problem, so one can only assume that description comes from the summary author.
Anyone can slip up.
Ah, but this is Slashdot, where corporations are composed of primordial evil and capitalism is the beefy fart of the Devil. Every slip up is cause for running to the hills to prepare revolutionary strikes, and then run to the other hills and plan counter-revolutionary terror, and we all run around like decapitated chickens shouting comforting mantras like "Information wants to be free!" and "It am teh suk!"
If you let someone have full access to your computer, they can delete personal files and directories! News at 11!
The Reg is currently questioning Apple's approach even in addressing well-known security vulnerabilities that it has actually acknowledged:
http://www.theregister.co.uk/2007/12/15/apple_security_fixes/
Really, if the public terminal isn't configured to automatically clear the data when the person has finished there's a problem.
According to this post, signing out of .Mac doesn't actually sign you out of the iDisk.
Step 5. Notice that clicking the big LOG OUT button doesn't affect iDisk.
Am I the only one that notices that Apple's response to every problem is a swift "let's delete this topic and pretend the problem doesn't exist"? .. Seems like bad business practise to me.
This happens all the time on corporate forums. The really infuriating part is that the admins also delete posts advocating a move to another forum without censorship. The only way to take discussion to sane place is to find topics before they've been deleted, see who's interested enough to post in those threads, and PM them with an invitation to a different forum.
I thought that session cookies died when the browser window closed - or does .Mac use URL rewriting?
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
That's why I "like" Apple.
If you don't like something about them, it's you who is wrong.
And now, if you suspect/have proved a security flaw, you still are on the wrong side of things.
Microsoft locks you in to software, leaving hardware selection free, Apple locks you in completely. Now tell me who's worse.
A far more pressing concern is that data is transmitted to and from your iDisk insecurely. No one should be storing any sensitive data on their iDisk.
I wonder if this article is about how Apple is sweeping problems like dust, under the carpet. Sounds very Microsoft'ish. However, it's also very likely that Apple really takes care of those problems, but I don't understand why to hide them as if they didn't exist at all.
Or they could use a session cookie that is deleted when the browser is closed.
Patrick Doyle
I mod down every jackass who puts his moderation policy in his sig. Oh, wait a sec....
This sounds like an opportunity for Apple to add a logout feature for HTTP Basic authentication to their browser. After all, they control both the browser and .mac; they can make this work. I've never understood why there is no logout feature for HTTP Basic authentication.
.mac actually uses HTTP Basic auth for authentication (if I were to guess I would guess not), but still.
I don't know if
Please correct me if I got my facts wrong.
If it was Microsoft deleting posts which they didn't like the blogers would be frothing at the mouth and looking for ankles to bite.
Apple, which has a long history of this, seems to go unnoticed.
No sig today...
If someone has physical access to your machine, you're completely screwed 5 ways from Sunday REGARDLESS of the access controls in place. There is NO protection from such an attack. Consider the situation where the site did require a login: the person who gains access to your machine then installs a keylogger and steals your password. SAME conclusion. The key concept here is that no security is invulnerable once you lose control of the hardware. The RIAA and MPAA have been learning this lesson for the past few years. The only way to secure your data, is to encrypt it and carry the security token which holds the decryption hardware and/or key with you. Given enough brute-force or cryptanalysis, even this solution is vulnerable. Some future advancements in security might solve this fundamental problem, but given current knowledge it's simply impossible. In conclusion, the design of Apple's iDrive service is not a security flaw.
Higher Logics: where programming meets science.
In Firefox: Ctrl+Shift+Del = solves problem In Internet Explorer: Tools --> Delete Browsing History = also solves problem.
I though all Macs were used for doing some graphics. How risky can it be?
(/sarcasm)
"Win treats sysadmins better than users. Mac treats users better than sysadmins. Linux treats everyone like sysadmins."
But if those opportunities lead to nothing serious, then it still doesn't matter.
What matters though, is for Apple to make sure they fix every vital security flaw they can with current software, implement even smarter security design in the future and continue to be the better choice for those who use their computer for traditional computing, ie. in the creative and journalistic area, internet-related usage (e-mail, web, IM, SFTP) and *NIX (ssh, text editing, programming, etc).
"People are stupid. Persons are smart" -- Agent K, MiB.
Right next to your username.
"Win treats sysadmins better than users. Mac treats users better than sysadmins. Linux treats everyone like sysadmins."
It is no different from leaving the house open and blaming the manufacturer of your dining table manufacturer for not protecting against this possible scenario.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Let's try it with
History > Clear history
Apple+Option+E...
"Win treats sysadmins better than users. Mac treats users better than sysadmins. Linux treats everyone like sysadmins."
when it comes to Apple. But you screwed up: when you're jerking that knee at something they've done, you *must* include the requisite statement: "but if this were Microsoft, you'd all be up in arms..."
Apple used to be a good company...ten years ago.
Ten years ago their stock was ~$15 a share. Right now it's $190 per share, and that's after a few splits. I would trade one of your kidneys for a few hundred shares of 1997 Apple stock.
You realize that the post was probably deleted by someone in poorly-trained low level support monkeys, right? Apple has a bug reporting system and an email for security issues. Use them, not the forums, if you want to make sure the post is actually evaluated by someone with understanding of... well, anything technical.
You are merely describing what may be the specific shortcoming of Apple's organization. By ignoring the report because it was made via an inappropriate channel the monkey is in reality making a determination of the validity of the report. The monkey should forward the report to a non-monkey.
admittedly not relevant for everyone, but synchronizing calender, contacts mail accounts and bookmarks across various macs/users/offices is really great. If there is something cheaper that works as reliably and easily (automatically without being prompted) I would like to know. I don't use any of the other features although the gallery is nice.
...chuckling not only at the security issues that are popping up, but at Apple's reaction to all of them.I've been working in the security industry for years. I've submitted bugs to Apple, MS, and various Linux and BSD projects. Apple's reaction to such submissions has been better than average. For the most part, they seem to acknowledge security related bugs and fix them before they are exploited, including providing credit to the bug reporter. I guess what I'm saying is, if you're judging "Apple's" response to security related bugs, maybe looking at how they handle problems reported to them through their publicly accessible bug reporting system is a better measuring stick, than looking at how they handle posts in forums. Not that I approve of censoring their forums, it just doesn't seem to be an important aspect of how they respond with regard to security. Not to sound like an Apple fan or anything, but I've frankly been impressed by Apple's quick turnaround on serious bugs.
I saw the title, "A Little .Mac Security Flaw", and immediately thought of the campaign song of George B. McClellan when he challenged Abe Lincoln in the 1864 presidential primary. His campaign song began with the lines: "Little Mac, Little Mac, You're the very man, go down to Washington soon as you can." and no, it's not because I'm a history maven or Civil War buff. When I was a kid I had a record, "Huckleberry Hound for President", built around Huckleberry Hound running for president, and one of the things they did was go through old presidential campaign songs looking for something to use for Huckleberry.
The things that stick in your head from when you're a kid.
In theory, theory and practice are the same; in practice they're different. (Yogi Berra & A. Einstein)
I think that "de facto standard" is undergoing the same illiteracy shift as "treasure trove" did, where people don't understand how to parse the phrase, mistake the noun for the adjective and vice versa, and start using the adjective as if it were the noun. Please, help fight this shift in the language. "De facto" is a much more important term than "trove" ever was, so it's essential to our continued ability to communicate effectively that it not lose its meaning and come to just mean "standard." Thank you for your support.
People keep saying '.mac has a logout button' and 'you can just click here and here to delete your cookies'. That's not the story! The idisk software is lacking a logout button, it is PART of .mac, not .mac. And if you didn't get that from reading the article, surely you understood it from reading other posts. In their rush to defend the indefensible, they blew past the article and and said something that is arguably moronic.
Before you mod me troll or flamebait, it's just an observation not an attack on anyone.
function logout() { // kill cookie / session
}
(yes I know Jscript is a poor choice of language here, I am simply proving a point)
In the time it has taken me to read this thread, this issue could have been fixed. As a mac user, I am very disappointed in such a simple, yet potentially deadly flaw. I am even more disappointed in the forum admin deleting the thread. I am even more disappointed in the posters on /. who are defending this, simply because it happened to "our side".
This should have been fixed within an hour of being reported. My clients are much, much smaller than Apple, and they have far better web security than this. Simply unacceptable.
Bad timing too. I was considering upgrading to Leopard, and paying for a .mac to use remote backup. Now I wonder how secure my data would be. More damaging: I don't trust this company to tell me if a problem appears.
barack to the future?
There is an option to reset Safari, the same way Firefox does its clearing private data. It's found in Safari -> Clear Private Data.
On top of that, there's a mode specifically made for public terminals called "Private Browsing" which automatically deletes all session data when the browser window closes.
Along with the lack of a logout button, the problem here is compounded by users not using the software properly.
...and I'm sure they'll respond quickly to this one as well. The point I was making was not about the speed of their response, but rather about Apple's reaction - which is censoring posts and trying to sweep the bad press under the rug. They're more interested in trying to maintain an image than disclosing the issue, which is what everyone else in the OS market does. I don't recall MS or any of the *nix flavors ever *actively* trying to prevent news of an expliot from getting out.
Obviously you did not read the article, as the issue here is said log out button doesn not work with iDisk.
Because I am a mean old man, on at least one occasion I have visited the Apple store only to find someone has parked their new car in the parking lot...
How does this make me a mean old man?
When I find that mistake has been made, I run my key down the side of their car before leaving.
I have to admit, I never thought of looking for new tires, but I am not sure I am mean enough to slash someones tires...
Though I have considered smashing their windows.
I am trying to educate little darlings.
That's precisely what you're saying, otherwise Apple should just pay it's security team to be the forum administrators so that nothing is missed. You can't tell someone to forward some things and not others without asking them to evaluate the messages to determine which need forwarding. In order to evaluate which need forwarding, you need technical knowledge about what is being discussed.
So because it's a web interface it isn't software? It doesn't require any technical knowledge to evaluate? That doesn't even make any sense. There's no difference between a web interface and a standalone application interface in terms of telling a security issue from someone just bitching or being an idiot.
Nor will misrepresenting mine. Triage is one of the most important and time-consuming parts of dealing with bugs and security issues, and if you think Apple's finest programmers are running the first-line triage on the bug database, you're crazy. They have a whole staff with actual technical training and resources available whose sole job it is to do that triage, and basically what you're suggesting is that every single Apple employee should be trained in those skills and have those resources, or that the triage team should take over every form of communication "just in case".
Because unless every Apple employee from the janitor to the shipping clerk knows as much as the triage team, they DON'T have the skills necessary to know what does and doesn't need to be reported to the triage team (hi, I'm a catch-22, nice to meet you!).
Recursive: Adj. See Recursive.
It's more like finding someone had left their keys in their car's door... and moving the car to a far part of the parking lot to teach them a lesson. Someone once told me they'd done that, and was surprised that I didn't think it was terribly funny.
Surely there's some way in iChat to leave them a note.
There's many classes of related problems here.
.Mac login screen would have a warning against using it from any location where this exploit was possible in the first place, and you would be able to indicate that you were working from an untrusted location, and if so you would be automatically prompted for your password after what most people would consider an annoyingly short period of inactivity...
... particularly at public locations ... really shouldn't be used for anything more than googling restaurants and browsing wikipedia.
You have sessions that are not terminated explicitly when the user leaves the work area. Leaving yourself logged in has been a problem as long as there's been remotely accessed computers. I remember sitting around in the computer center in the dark back in the '70s because the mainframe we were using automatically resumed checkpointed jobs and the computer center had a policy of not terminating them for power outages less than some period of time.
You have reusable authentication tokens or session IDs that aren't automatically revoked.
These combined are a common problem thanks to the statelessness of the web.
Adding to that the inability to explicitly log out?
Not good.
On the other hand, using shared devices with non-trivial persistent state is also a problem. At Usenix one year the word went out that everyone who had used Kerberos logins at the Usenix terminal room should change their passwords, because they'd found some trapdoored Kerberos software on a terminal there. As originally designed, Kerberos was meant to be used with workstations that were trivially re-imaged over the network... they had no persistent state. Now whether Athena workstations were really used that way or not, I don't know, I wasn't at MIT... but the intent was that they be treated as dataless workstations.
Any system running a web browser, unless it's operated by someone you trust and either re-imaged before you use it or locked down so that even a local attacker using the browser can't initiate a remote execution exploit on it, is not sufficiently secure that you should be trusting it with passwords or other authentication tokens that can be used to access any resources that you actually care about.
If Apple wanted to really attack security here, then the
And track IP addresses, so if you log on from an IP address that someone else had used, you got put in this mode automatically.
But, really, shared computers
"No one is saying that a forum admin should evaluate the validity of the issue."
... You can't tell someone to forward some things and not others without asking them to evaluate the messages to determine which need forwarding. In order to evaluate which need forwarding, you need technical knowledge about what is being discussed.
... They have a whole staff with actual technical training and resources available whose sole job it is to do that triage, and basically what you're suggesting is that every single Apple employee should be trained in those skills and have those resources, or that the triage team should take over every form of communication "just in case".
Because unless every Apple employee from the janitor to the shipping clerk knows as much as the triage team, they DON'T have the skills necessary to know what does and doesn't need to be reported to the triage team (hi, I'm a catch-22, nice to meet you!).
That's precisely what you're saying, otherwise Apple should just pay it's security team to be the forum administrators so that nothing is missed...
I said no such thing. I was quite clear that the forum admin should *not* be reporting directly to developers, that there should be a qualified person to accept the report and decide if it has merit, and that person forwards to developers.
No. If you do not possess the technical knowledge, or the authority to make the call, you forward it to someone who does, and again that should probably not be the developers.
"Also you are creating a silly red herring. This particular security problem is independent of hardware or software. The problem and fix lie in a *web* interface"
So because it's a web interface it isn't software? It doesn't require any technical knowledge to evaluate? That doesn't even make any sense. There's no difference between a web interface and a standalone application interface in terms of telling a security issue from someone just bitching or being an idiot.
You wrote: "that user forum administrators are in no way able to evaluate what is a stupid user error vs what is an actual security issue across the hundreds of different hardware and software combinations Apple offers." The complexity you speak of is irrelevant, this is not application or OS code. The testing matrix is not all supported hardware models, it is the currently supported versions of Safari.
Triage is one of the most important and time-consuming parts of dealing with bugs and security issues, and if you think Apple's finest programmers are running the first-line triage on the bug database, you're crazy...
This is rediculous, your misrepresentation can not be accidental. I have written on multiple occasions that the forum admin should *not* be reporting directly to the developers. That the admin should be reporting to someone else, that this designated person filter out the noise.
Actually, what I am suggesting is the following. Apparently you missed it, from my older post: Either a forum admin failed to report a security issue or they forum admin reported it and no one felt the need to update a *web interface* in a timely manner. Either scenario indicates that something is lacking at Apple.
Klaatu barada nikto!
Way to not read TFS, let alone TFA! The issue is not someone having access to your computer; the issue is logging onto your iDisk remotely from a public computer, and not being able to log out. This allows someone to track back through the browser history, and access your iDisk with your login credentials.
-Mike
I'm sorry; I don't know what I was thinking!
(From Safari Help)
When private browsing is turned on:
Webpages are not added to the history list.
The Downloads window is cleared so the name of anything you downloaded won't appear in the list. (To get rid of the downloaded item itself, you must delete it.)
Information isn't saved for AutoFill, including names and passwords.
Searches are not added to the pop-up menu in the Google search field.
Cookies are deleted.
(Yes, I was a dick, I think I made that perfectly clear in the text.)
For the analogy to be correct, the new car would have to have been left running, unlocked, and unattended in the parking lot and I would have had to take it out and get it what? have it cleaned?
People who leave their cars running and unlocked and unattended get their cars stolen all the time. I didn't "steal" the account nor do the equivalent of taking the keys and throwing them into the bushes.
I also didn't take the car for a ride and run it into things or rack up a bunch of red-light camera offenses. (other people had been sending messages on the account).
Nor did I copy down the registration information and use it for my own purposes (someone had been looking through chat logs for phone numbers and such if the open window contents were to be believed).
So yea, I was a dick. Not my best moment by a long shot. I started with that. But at least criticize me with a reasonable analogy and perhaps understand why I shared the story in the form of a cautionary tale. 8-)
Innocent people shouldn't be forced to pay for inferior software development.
--"Code Complete" Microsoft Press
Comment removed based on user account deletion
We don't know if Apple REALLY removed comments, or if this guy is just claiming they did. Secondly, we don't know the content of his comments. Perhaps they were vile and inappropriate and/or non-contructive? I'm trying to find more "proof" of this claim, but there is nothing linked in this /. "story". There's always a second side to the story as they say...
What a minute, I've looked through all of the 4 mod level posts here, and I see defenses and attacks on apple, but has anyone actually bothered to try this?
So... what the hell? Of course, what is a little more serious is that this data is all being sent plaintext, but the story as posted doesn't seem to be true, at least based on my casual test.
Also, isn't it considered good form to bother providing a link to the story we're summarizing? I know this is slashdot and no one bothers to read the text anyway, but for those that do, having to copy/paste URLs and browsing the site for the story being discussed is kind of stupid.
I am not disagreeing with a single thing you said. It sounded like the parent wanted the report read by someone knowledgeable, and I pointed them in the right direction. If the goal was indeed to get it before eyes, I helped. If it was merely to complain, I did no damage. Nowhere did I defend any policy, only describe it.
If you look at any Finder window, you have a bar on the left hand side. If you right-click on the iDisk icon, you get a pulldown menu with the Eject option...
At least this works for my own iDisk on my own Mac.
If you don't see the bar on the left, you should activate it with the tiny rounded-rectangle button on the upper right of the Finder window.
Funny, I seem to have a logout button too (and had one long before this "article" came out). And if, after clicking it, I "go back" in the browser, I have to log in again. Nothing gets cached for me. Now if I mount the iDisk on my desktop, it tends to hang around, but then that's how network drives are supposed to work. Cheers, tb
While I enjoy a false dilemma as much as the next man, this is a ludicrious position. User X reports a problem. Admin Y on a webboard sees it, tells other Apple employee Z about it. Z tells Y that it is known, or unknown and they will deal with it, whatever. Y then a) Fills out a for so that other webboard admins know about the issue (if not done automatically as a sideeffect of telling Z), messages X to let him know what is going on, and, if it is a false issue, removes it or adds a comment to the story.
Your ad here. Ask me how!
I didn't buy it so I tried it. I opened Safari and connected to my iDisk on the web. I quit Safari and went into history and I was asked for a password. I guess had I not quit safari and the session had not timed out, maybe then but I think I could run into that on Amazon! Am I missing something? Maybe that is why Apple deleted the posting because it was wrong! Just a thought?